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Abstract 

We consider an approach to deciding isomorphism of rigid n-vertex graphs (and re- 
lated isomorphism problems) by solving a nonabelian hidden shift problem on a quan- 
tum computer using the standard method. Such an approach is arguably more natural 
than viewing the problem as a hidden subgroup problem. We prove that the hidden shift 
approach to rigid graph isomorphism is hard in two senses. First, we prove that f2(n) 
copies of the hidden shift states are necessary to solve the problem (whereas 0(n\ogn) 
copies are sufficient). Second, we prove that if one is restricted to single-register mea- 
surements, an exponential number of hidden shift states are required. 

1 Introduction 

One of the major challenges of quantum computing is to determine whether there exists 
an efficient quantum algorithm to decide if two graphs are isomorphic. It is well known 
that the graph isomorphism problem can be reduced to a hidden subgroup problem over 
the symmetric group 017120 20 . This approach seems to be promising since hidden 
subgroup problems over many groups, including arbitrary abelian groups {Tl ll6ll2"51l321 
and some nonabelian ones |H ll3tlT51l21U25| can be solved efficiently on a quantum 
computer. An efficient quantum algorithm for graph isomorphism would be interesting 
since no efficient classical algorithm for the problem is known; the best known classical 
algorithm for deciding isomorphism of n-vertex graphs runs in time O{n^ cn ^ logn ) for 
some constant c [2]. 

Unfortunately, the only results so far on the quantum complexity of the graph iso- 
morphism problem consist of evidence that the problem might be hard (with the notable 
exception of the result that the query complexity of the associated hidden subgroup 
problem is polynomial |10|h The graph isomorphism problem can be reduced to a hid- 
den subgroup problem in S^n where the hidden subgroups are generated by full support 
involutions. Hallgren, Russell, and Ta-Shma showed that weak Fourier sampling, in 
which one performs a nonabelian Fourier transform but then only measures the name 
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of an irreducible representation, is insufficient to solve the problem 18 . Kcmpe and 
Shalev generalized their result to show that finding other subgroups of the symmetric 
group is also hard |22|. Finally, Moore, Russell, and Schulman have obtained results 
about the need to use multi-register measurements on the hidden subgroup states ob- 
tained by Fourier sampling. In particular, if one is restricted to single-register measure- 
ments (in the standard approach known as strong Fourier sampling), an exponential 
number of hidden subgroup states is required |27| . Similarly, if one is restricted to 
two-register measurements, then a superpolynomial (though possibly subexponential) 
number of hidden subgroup states is required 26 . Strictly speaking, these results do 
not show that the hidden subgroup problem directly relevant to graph isomorphism is 
hard, since the possible subgroups resulting from the graph isomorphism reduction are 
not generated by arbitrary full support involutions, but by involutions having further 
properties (as we will discuss further in Section |3J in connection with the hidden sub- 
group problem over S n I Z2). However, concurrently with the present work, Moore, 
Russell, and Schulman have improved their result for single-register measurements to 
cover the special case directly relevant to graph isomorphism |28| . 

In this paper, we study an alternative approach to solving graph isomorphism on a 
quantum computer, by viewing it as an instance of a nonabelian hidden shift problem. 
This approach is arguably more natural than viewing the problem as a hidden subgroup 
problem: every possible hidden shift corresponds to a possible isomorphism (whereas 
there are many subgroups of either S^n or S n 1 1i that do not correspond to isomor- 
phisms); and furthermore, viewed as black box problems, the hidden shift problem can 
be reduced to the hidden subgroup problem. The hidden shift problem can be tackled 
on a quantum computer using a standard method that closely parallels the standard 
approach to the hidden subgroup problem. We present two hardness results for this 
standard approach to the hidden shift problem over S n . 

First, we prove that f2(n) copies of the hidden shift state are necessary to solve the 
problem (whereas 0(n log n) copies are sufficient). The idea behind this bound is the 
simple observation that the hidden shift problem for the largest abelian subgroup of S n 
is at least as hard as for the whole group S n . In the case where the group G is abelian, 
the hidden shift problem for G is equivalent to the hidden subgroup problem over the 
generalized dihedral group G x Z2 , and it is straightforward to obtain a reasonably tight 
bound for this case using a connection to the subset sum problem over G. Since S n 
contains large abelian subgroups, the resulting bound for the nonabelian hidden shift 
problem is not too bad. 

Second, we present a simple proof that single-register measurements are not sufficient 
to solve the hidden shift problem over S n . In fact, this result holds for any group that 
has many irreducible representations of sufficiently high degree. In particular, the only 
property of S n used in the proof is the fact that under the Plancherel distribution, an 
irreducible representation of S n with degree larger than n e ^™^ occurs with probability 
at least l-n" n W. 

The remainder of the paper is organized as follows. In Section we define the 
nonabelian hidden shift problem and discuss the standard approach to solving it. In 
Section |31 we discuss how isomorphism problems (including, but not limited to, graph 
isomorphism) can be cast as hidden shift problems. In Section ^ we prove the linear 
lower bound on the required number of copies of hidden shift states. In Section [5] 
we examine the structure of the hidden shift states for arbitrary groups and obtain 
some results needed for Sectional where we show that single register measurements are 



2 



insufficient . Finally, in the Appendix, we present some additional results on the rank 
of the hidden shift states. 



2 Nonabelian hidden shift problem 

The (nonabelian) hidden shift problem is the following. We are given black-box access 
to two functions /o : G — > S and fx : G — *■ S where G is a (nonabelian) group and S is 
a finite set. The functions are promised to satisfy two conditions: 

1. Both /o and /i are injective. 

2. Either there exists a fixed hidden shift s £ G such that fo(g) — fi(gs) for all 
g G G, or the images of /o and j\ are disjoint (in which case we say there is no 
hidden shift). 

The goal is to determine whether there is a hidden shift s or not. 

The case where G is an abelian group has received considerable attention pfll^l llll 
H3U24ll5l)ll31| . Since inversion is an automorphsim of any abelian group, the hidden shift 
problem in G is a hidden subgroup problem in the generalized dihedral group G x Z 2 
where Z 2 acts by inversion. In particular, the case where G is cyclic is the well-known 
dihedral hidden subgroup problem. However, the case where G is nonabelian, in which 
case the hidden shift problem is not a hidden subgroup problem, seems not to have been 
studied extensively. 

In this paper, we focus on a particular natural approach to solving the hidden shift 
problem on a quantum computer, paralleling the standard quantum approach to the 
hidden subgroup problem. First prepare a uniform superposition over i G Z 2 and g G G, 
and then compute the value of fi{g), giving the state 

-^=J2(\0,gJ (g)) + \l,gJi(g))). (1) 

V 2 I G I g€G 

Then measure the third register. If there is a hidden shift s, then we are left with the 
state 

\^, g ):=^(\0,g} + \i,gs)) (2) 

for some uniformly random (unknown) g G G. On the other hand, if there is no hidden 
shift, we obtain the state \i,g) for some uniformly random (unknown) i G Z 2 and g G G. 
Thus the density matrix obtained by applying the procedure is either 

7i(*):= |i|El^,»X^I (3) 
1 1 gee 

if there is a hidden shift s G G, or the maximally mixed state 

72 := 2^|/ a|G | (4) 

if there is no hidden shift. Using the state thus obtained, we would like to decide 
whether there is a hidden shift or not. 
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In general, we can apply the above procedure k times to obtain k copies of the 
hidden shift state (or the maximally mixed state if there is no hidden shift). Clearly, 
these states become more distinguishable as k is increased. Suppose that in the case 
where there is a hidden shift s, it is equally likely to correspond to any element of G. 
Then the problem is to distinguish the two density operators 

where j[ k) (s) := j 1 (s)® k . 

A natural generalization of the nonabelian hidden shift problem involves the case of 
M injective functions, fj for j £ {0, 1, ... , M— 1}, satisfying fj (g) = fj +1 (gs) for a fixed 
s £ G for all j £ {0, 1, . . . , M — 2}. This problem becomes easier as M is increased, and 
is interesting in the case where G is cyclic, since it has an efficient quantum algorithm 
provided M is sufficiently large [Sj. We will not consider the generalized nonabelian 
hidden shift problem further in this paper, although it is an interesting question whether 
this problem has an efficient quantum algorithm even for M sufficiently large. 



(fe) 
7i : = 



(fc) 

72 



3 Isomorphism problems 

The nonabelian hidden shift problem for the symmetric group is especially interesting 
since an efficient quantum algorithm for this problem would yield an efficient algorithm 
for graph isomorphism (and more generally, for other related isomorphism problems). 
The usual quantum approach to graph isomorphism relies on a reduction to the hidden 
subgroup problem for the symmetric group, but the hidden shift problem for G = S n 
presents an alternative approach that seems to be at least as natural, and is arguably 
more so. 

We now describe a generalized isomorphism problem that reduces to the hidden shift 
problem. For each n £ N, let C n be a set of objects of size n. For example, C n could be 
the set of graphs on n vertices. We assume that the objects can be uniquely represented 
using poly(n) bits. 

Let G n be a family of (finite) groups such that each G n acts on C n . For g £ G n and 
C £ C n , let g(C) denote the element of C n given by the action of g on C. We call two 
objects A,B £ C n isomorphic if there is some g £ G n such that g(A) = B. We call an 
object C £ C n rigid if it has no automorphisms, i.e., if there is no g £ G n — {1} such 
that g(C) = C. 

The C -isomorphism problem is the following. Given two rigid objects C$,C\ £ C n , 
determine whether they are isomorphic or nonisomorphic. It is straightforward to reduce 
this isomorphism problem to a corresponding hidden shift problem: simply let fi(g) := 
g{Ci). (The assumption of rigidity is required to ensure that /o, /i are injective.) 

Graph isomorphism is the special case of the C-isomorphism problem for G n = 
S n where C n is the set of graphs on n vertices, and the action of G n is to permute 
the vertices. Thus, a solution to the generalized hidden shift problem for G n = S n 
would give an efficient algorithm for testing isomorphism of rigid graphs. But such an 
algorithm could also be applied to other isomorphism problems. For example, if we let 
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C n be the set of all binary linear codes of length n, where G n — S n acts to permute the 
bits of the code words, then we obtain the code equivalence problem discussed in |10| . 
which is at least as hard as graph isomorphism |29|. 

As mentioned in the introduction, the usual approach to solving graph isomorphism 
on a quantum computer is based not on the hidden shift problem, but on the hidden 
subgroup problem. Graph isomorphism can be cast as a hidden subgroup problem over 
5*2,1 where the hidden subgroups are generated by full support involutions. A more 
careful inspection of the hidden subgroups that occur in this reduction shows that it is 
sufficient work with a subgroup of S^: as proposed by Ettinger and H0yer, one can cast 
graph isomorphism as a hidden subgroup problem over the wreath product S n l%2 < Sin 
where the hidden subgroups are generated by so-called involutive swaps 

How are the hidden subgroup and hidden shift approaches to graph isomorphism 
related? In general, one can show that the hidden shift problem in a group G can 
be reduced to the hidden subgroup problem in G I Z2. In particular, the hidden shift 
problem in S n reduces to the hidden subgroup problem in S n I Z2 (and in fact, using 
the results of [HE!, one can also show that it reduces to the hidden subgroup problem 
in Sin). Since the hidden shift problem is no harder than the corresponding hidden 
subgroup problem, this suggests that the hidden shift problem might present a more 
natural quantum approach to graph isomorphism. However, we emphasize that our 
hardness results about measurements of hidden shift states do not imply corresponding 
results about hidden subgroup states, since the reduction does not necessarily still hold 
when we assume the use of the standard method to produce particular quantum states. 



4 Lower bound on the number of copies 

In this section, we show that fi(ro) copies of the hidden shift states are needed to 
successfully determine whether there is a hidden shift. We do this by showing that the 
optimal POVM is unlikely to produce the correct answer unless k = fl(n). 

Consider the general problem of distinguishing a pair of (possibly mixed, a priori 
equiprobable) quantum states. The optimal measurement for this problem (in the sense 
that it maximizes the probability of successfully identifying the state) was discovered 
by Helstrom |19j , and is as follows. Suppose we wish to distinguish the quantum states 
P\iPi- Then let E± be the projector onto the eigenvectors of p\ — P2 corresponding 
to positive eigenvalues, and let Ei be the projector onto the eigenvectors of p± — pi 
corresponding to negative eigenvalues. (Eigenvectors in the nullspace of p\ — pi can be 
associated to either E\ or E2 without affecting the success probability.) 

(k) 

In principle, Helstrom's result tells us the optimal measurement to distinguish 7J 

( k) 

and 72 . Unfortunately, since we do not have a good understanding of the spectrum 

(k) 

of 7^ for nonabelian groups, we do not know how to estimate the success probability 
of the Helstrom measurement in such cases. However, we can obtain a good estimate 
of the success probability for abelian groups, and we can obtain a bound for arbitrary 
groups since a bound for a subgroup implies a bound for the full group. Specifically, we 
have 

Lemma 1. The number of copies needed to solve the hidden shift problem in the group 
G (with a probability of success bounded above 1/2 by a constant) is at least as great as 
the number of copies needed to solve the hidden shift problem in any subgroup H < G. 
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Proof. Clearly, if the possible hidden shifts are restricted to be from a subgroup H < G, 
the problem is at least as hard as when the hidden shift may be arbitrary. For a 
uniformly random hidden shift s € H , the density matrix when there is a hidden shift 
is 

' ' heH 

which can be written as the tensor product of the unrestricted hidden shift state in H 
and a maximally mixed state of dimension |G|/|if|. Since the maximally mixed state 
provides no information about the hidden shift, the restricted problem in G is equivalent 
to the hidden shift problem for H . □ 

Now we give a general lower bound on the number of copies needed to solve an 
arbitrary abelian hidden shift problem. In the abelian case, we can give fairly tight 
bounds using the close connection between the hidden shift problem and the subset sum 
problem |3]. Specifically, after performing a Fourier transform on the group register, we 
can write the abelian hidden shift states as 

^ )(s)= f2W^ ^ X w {s)x,{s)^l\Sl,x){S x v ,x\ (8) 

where 

SI ■= {b e A : b ■ x = w} (9) 

is the number of 

(10) 

is the normalized uniform superposition over those solutions (where we define \S^) := 
in the event that 77* = 0). Thus, with a uniformly random hidden shift, we have the 
state 

^ k) = i £ £^m>mi- ( n ) 

x£G k wGG 

In the standard approach to the abelian hidden shift problem, our goal is to distin- 
guish this state from the maximally mixed state. An optimal measurement for doing 

~(k) 

so is the measurement that projects onto the support of 7^ . Since the eigenvalues 
of 7^ are integer multiples of l/(2|G|) fe , the operator 7^ — 72 is nonnegative pre- 

~(k) 

cisely on the support of 7J . Therefore, the projection onto that support is a Helstrom 
measurement, and hence is optimal. 

Having identified an optimal measurement, we can now show 

Lemma 2. For any abelian group G, k — f2(log \G\) copies of the hidden shift states are 
needed to decide whether there is a hidden shift (with a probability of success bounded 
above 1/2 by a constant). 



is the set of solutions of the subset sum problem over G, rf^ := 
such solutions, and 
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Proof. The success probability of the optimal measurement (in which E\ projects onto 
the support of 7^ and E2 projects onto its complement) is 

Pr(success) := i ( tr S^f ] + tr } ) ( 12 ) 
rank 71 

= 1 ~ 2(2|G7|) fe ■ (13) 

Now 

rank 7 f ) -^<5te>0] (14) 

X,W 

= |Gr i -^%S=Q]. (15) 

a:, if; 

(For the case G = Zjy, the rank is given by the integer sequence |^ A098966]. For a 
discussion of the rank in the general (not necessarily abelian) case, see the Appendix.) 
To evaluate this expression, we need to understand the typical behavior of In 
particular, it is helpful to know the first and second moments of rf^ for uniformly 
random x € G k , w € 67. For an arbitrary group G, the first moment is 

,i := Et)* = . (16) 

z,tu I Or I 

For the second moment, we have 

E(« 2: =iGFiEte) 2 (17) 



167 



^r£(£<w) 2 (is) 



x, to b 



i^ifc+i yiyi ^iM^Km (1^) 

X,W by^C 

^ + 1,4+1 ££W* ( 2 °) 

11 x b^c 



2 k (2 k - 1) 
|G| 2 



(21) 



Here in the final step we used the fact that for fixed b 7^ c (with bk 7^ Ck without loss 
of generality), and for fixed x\,... ,Xk-i S 67, there is exactly one Xk G G such that 
b ■ x — c ■ x. In terms of the variance a 2 := E^^) 2 — /x 2 we have the inequality 
Pr« = 0) < d 2 /^ 2 + a 2 ) P, giving 

rank 7 f } > |c7| fc+1 ^^ (22) 

= l G l* + '(" + 1 -p)" < 23) 

> (2|67|) fc - IC?!^ 1 . (24) 
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Thus, wc find 



, \G\ 



Pr(success) < -[ 1 + y ) . (25) 



For the success probability to be bounded above 1/2 by a constant, we need k — 
fi(log | G\) as claimed. □ 

Putting these lemmas together, we have 

Theorem 3. To solve the hidden shift problem in S n , Q(n) copies of the hidden shift 
states are necessary. 

Proof. The largest abelian subgroup of S n has size 3 e (") (see also EH A000792]). 
Combining Lemmas ^ and [21 gives the result. □ 

This result is not too far from the best possible, since 0(log \G\) copies are sufficient 
to solve the hidden shift problem for any group G. This follows easily from and the 
fact that rank 7^ < |G| fe+1 , and is analogous to the well-known result that 0(log \G\) 
copies of hidden subgroup states are sufficient to solve the hidden subgroup problem 
[T^] . However, there is a logarithmic gap between these lower and upper bounds. We 
suspect that the lower bound could be improved, since it only uses information about 
abelian subgroups, but without a better understanding of the structure of the hidden 
shift states for large k, it seems difficult to establish a bound. 

Note that an analogous bound of O(n) has recently been independently established 
for the hidden subgroup problem over S^n where the hidden subgroup may be an ar- 
bitrary full-support involution, and a bound of tt(n\ogn) has been established for the 
hidden subgroup problem over S n I Z2 |17j . 

(k) 

It is worth noting that while the projection onto the support of 7^ is an optimal 
measurement in the abelian case, it is not an optimal measurement in general. For ex- 
ample, for G — Si, "f[ 3 ^ has eigenvalues between and 1/(2|G|) 3 , so that the projection 
onto the support is not a Helstrom measurement. 



5 Structure of hidden shift states 

To show that single-register measurements are not sufficient to solve the hidden shift 
problem, we need to understand the structure of the states j[ k \s), j[ k \ and 72 . Here 
we determine their block structure and use it to compute the spectrum of 7} for k = 1 
and 2. 

Observe that 71 (s) has the following form: 

7i(s) = gjTTi E IM<0,<7| + |l,0*><l,fl*| + |0,.g)(l,<?s| + |l,$«><0,fl| (26) 

- — ( 1 m \ (27) 
~ 2\G\ \Ris- 1 ) I J ' [ 

where R is the right regular representation of G, defined by 

R(s)\g) = \gs~i) (28) 
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for all s,g G G. Recall that the regular representation contains all irreducible repre- 
sentations of G with multiplicities given by their dimensions. More precisely, we have 

FR(s)Fl = ®I dp ®p(s) (29) 

for all s E G, where F is the Fourier transform over G and G is a complete set of 
irreducible representations of G. In other words, the Fourier transform decomposes the 
regular representation into its irreducible constituents. 

Using the Fourier transform, the states j[ k (s), 7^ , and 72 can be simultaneously 
block diagonalized for any k e N. The blocks are enumerated by fc-tuples of irreducible 
representations. In particular, in the Fourier basis we have 

^ )(S)= (2W ® I dn - dpk ®B^{ S ) (30) 

( Pl ,...,p k )eG k 

^ )= (W ® (31) 
( Pl ,..., Pk )eG k 

12 ] = (2\G\) k ® Id n- d -k ® I ^ P1 -2d Pk (32) 

( Pl ,..., Pk )eG k 

where 

B ' "<•>-&(,>> t') (33) 

B' " := -i- Vb Pi <-^(s). (34) 
|G| sec 

Here the factor e? Pl • • • d Pk accounts for the multiplicity of {p\, . . . , pk) in k copies of the 
regular representation of G. 

It is straightforward to check that the blocks B pi '---' Pk (s) and B pi '---' Pk can be ex- 
pressed as 

B p u-, Pk{s)= J2 \*)(v\®K-£..,v>-*M ( 35 ) 

x,ye{0,l} k 
£C,j/£{0,l} fc 

where 

(*) - M** 1 ) ® M* 22 ) ® ■ ■ ■ ® M* 2 *) (37) 
^;:S : =^E^:::SW (38) 

for all z e {—1,0, l} fc . Clearly, the matrices A p \<-\-' Pk are hermitian, that is, A p \<\\\< Pk = 

■™--zi,...,-z k ■ 
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To understand the form of these matrices, we must carry out the sum in <|38|) 
for various choices of the irreducible representations pi , . . . , pk G G and the indices 
z±, . . . , Zk € {—1, 0, 1}. If all Zj have the same sign, then such a calculation is straight- 
forward, using the following well-known result: 

Lemma 4. Let tt be any representation of the group G. Then the matrix 

A: =^E^) ( 39 ) 

1 1 gee 

is a projection operator whose rank is the number of times the trivial representation 
appears in tt. 

Proof. Decompose the representation tt into irreducible representations. Let a be any 
irreducible representation occurring in tt. The sum B = t^t ^Z geG o~(g) is a multiple of 
the identity matrix because B commutes with all a(h) for h E G. The trace of B is the 
inner product of the trivial character and the character of a. Therefore, B = 1 if a is the 
trivial representation and B is the zero matrix if a is not the trivial representation. □ 

In general, we will have z/s of both signs. In this case we may say that A in- 
cludes both representations and antirepresentations of G, since g i— > p{g~ r ) is a group 
antihomomorphism. Fortunately, this case can be dealt with using the following: 

Lemma 5. Let p and a be two irreducible representations of G. Then the entries of 
the matrix 

1 1 sec 

are given by 

Ai,j;k,l = <W -j- Sj,k (41) 

Up 

where i,j are the row and column indices of the first tensor component and k, I are the 
row and column indices of the second tensor component. 

Proof. The entries are given by 

Ai,r,k,i = E Pv (9 ) ® o-ik(g) ; (42) 

then (|41|l follows directly from the Schur orthogonality relations. □ 

Now we are ready to investigate the blocks B p for k = 1 and the blocks B p p for 
k = 2. 

Lemma 6 (Spectrum for k = 1). The block B 1 has eigenvalues 2 and 0. For p ^ 1, 
B p = h do - 



Proof. Since p\(s) = 1 for all s, 



which has eigenvalues 2 and 0. For p ^ 1, J2 s eG P( s ) = ^ the orthogonality of p and 
1, so that B p = I 2 d as claimed. □ 
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Lemma 7 (Spectrum for k = 2). For any p 6 G — {1}, either B p ' p has the spectrum 
1 (multiplicity 2d 2 ) and 1 ± l/d p (multiplicity d 2 p each); or the spectrum 2 (multiplicity 
1), (multiplicity 1), 1 (multiplicity 2d 2 — 2), and 1 ± l/d p (multiplicity d 2 p each). 

Proof. For simplicity, we omit the label p, p. The block of interest has the form 



B 



( 1 


A),i 


Aifi 


Ai,i\ 




i 




Ai,o 


A-ija 




I 


A ,i 


\ A i,i 


^1,0 


A ,i 


1 ) 



(44) 



Recall that the blocks of B are enumerated by x, y £ {0, l} 2 . The matrix at position 
(x, y) is given by A y _ x , where the A matrices are defined by 



11 geG 



(45) 



for z E {— 1, 0, l} 2 . We have simplified (|44|l to minimize the number of — l's using the 
fact that A z is hermitian, so A z — A^ z . 

Since p ^ 1 by assumption, ^4q,i = j4io = by the calculation in LemmaEl Thus 



B 



( I 













I 


A lt -i 










I 





\Ai,i 








1 1 



I A hl 
A 1A I 



(46) 



Hence it remains to understand the operators and Ai^—i. 

Since p (and hence also p) is irreducible, the trivial representation appears at most 
once in p £3 p, so by Lemma^J A\ \ is either zero or a projector of rank one. Hence the 
matrix 

' I A lfl y 
A lA I 



(47) 



is either the identity, or has the eigenvalues 2 and with multiplicity 1, and 1 with 
multiplicity 2d 2 — 1. By Lemma El A\^\ has eigenvalues ±l/d p , so that 



I ^i.-i 
I 

has the eigenvalues 1 ± 1 / d p each with multiplicity d 2 



(48) 
□ 



6 Single-register measurements do not suffice 

In this section we show that single-register measurements do not suffice to efficiently 
solve the hidden shift problem for G = S n . 

Let us first explain in more detail what is meant by an algorithm restricted to single- 
register measurements. A POVM £ with a set of possible outcomes J is a collection of 
positive operators £ — {Ej : j G J} satisfying the completeness condition 

J2 E 3=I- (49) 

3 
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An efficient algorithm consists of a polynomial number of POVMs £ \ , . . . , £ t , each acting 
on a single copy of the hidden shift state. After obtaining the measurement outcomes 
ji , . . . , jt , a final computation is performed to decide whether there is a hidden shift or 
not. Note that the individual outcomes ji need not directly correspond to one situation 
or the other. Also, let us stress out that the POVMs £\ , . . . , £t may be chosen adaptively, 
that is, £ r may depend on all previous outcomes j±, . . . ,j r -i for 2 < r < t. 

To simplify the analysis, we can refine any POVM £ so that each Ej = aj\4>j){i)j\ 
where each is a unit vector and aj > without loss of generality. This is because any 
positive operator can be written as a weighted sum of projection operators, where the 
weights correspond to the eigenvalues and the projection operators to the eigenspaces. 
The result of this measurement on the state 7 is a random variable, where we obtain 
j G J with probability 

PU) = aMhWi) - (50) 

In our case, the POVM can be further simplified because the states j[ k \s), j[ , and 
72 can be simultaneously block-diagonalized as described in Section[S] The blocks are 
labeled by irreducible representations of G. Therefore, as in the hidden subgroup prob- 
lem, we may assume without loss of generality that we first perform a Fourier transform 
on the group register and then measure the representation name (so-called weak Fourier 
sampling). Next, we perform a measurement within the subspace corresponding to the 
observed representation. 

From the block decomposition of the states described in Sectional it is clear that the 
various irreducible representations of G occur independently according to the Planchercl 
distribution, i.e., 

pr (p)=i!p ( 5i ) 

regardless of whether or not there is a hidden shift. This is analogous to the fact that 
weak Fourier sampling is insufficient to distinguish between the trivial subgroup and 
the subgroups generated by full support involutions in the symmetric group |18| . 

Suppose we measure the representation name and observe a particular p £ G. Then 
consider an arbitrary POVM £ = {ai\^i){ipi\, . . . , a r \ip r ) {i/) r \} acting on the subspace 
of dimension 2d p corresponding to the observed representation. 

If there is no hidden shift (that is, if the state is 73 ), then the post-measurement 
state is l2d p /(2d p ), and the probability of obtaining the outcome j is 



P2{j) = ^ j \haM 3 ) = ^-. (52) 



We denote this probability distribution by P2. On the other hand, if there is a hidden 
shift s, then the post-measurement state is B p (s)/(2d p ), and the probability of obtaining 
the outcome j is 

Pi{j\s)-=^ r {^\B p {s)\i> j ); (53) 

we denote this distribution by Pi <s . We will also be interested in the distribution Pi 
obtained by averaging over s £ G, i.e., with the probabilities 

Pitf):=ji|5>i(j». (54) 
1 1 sec 
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Following 26, 27|, the strategy for proving that single-register measurements are not 
sufficient is to show that with high probability (over the hidden shift s and the observed 
representation p) , the statistics of the measurement results when there is a hidden shift 
s are close to those when there is no hidden shift. More precisely, we will prove 

Theorem 8. 

Pr (||P M -P 2 ||i >e- e ^) <e~ e ^ (55) 
sealed 

To prove this theorem, we first show that with high probability (over a uniformly 
random choice of s S G and the Plancherel distribution of irreducible representations 
p 6 G), the distribution Pi s is close to the distribution Pi. Then it suffices to show that 
Pi and P2 are typically close, which is straightforward (since in fact, they are typically 
identical) . 

Because P\ is the average of Pi jS over s E G, we can show that the distributions are 
likely to be close by showing that the variance of Pi(j\s) is small (so that we can apply 
the Chebyshcv inequality). More precisely, we will use the following: 

Lemma 9 (Upper bound on the sum of weighted variances). Assume we have 
measured the irreducible representation p =/= 1, and we perform an arbitrary measurement 
£ = {aj\ipj}(ipj\ ■ j € J}. Then 

£,2 S ? (56> 

where crj is the variance of pi{j\s) when s is chosen uniformly from G. 
Proof. For any fixed j the variance cr| is given by 

Recall that we have pi(j) = aj/(2d p ) for all j. This is because we have B p = l2d p for 
all p ^ 1 as shown in Lemma [5] 

The second moment can be expressed in terms of the block B p ' p . We have 

1ST E / l(i|s)2 = (OT £ (»' B " w '*» a < 58 ' 

,2 



a 3 



(2^) 2 |G| sk(; 
a 2 



(2 Jy £<MV>i|i^MM> (60) 
" 7 (^|(^|P p ' p |^>l^>- (61) 



~ (2d p ) 2 ^ 3lml mim 
Set A := \B PP — I\. Then we have for the variance the upper bound 



a 2 ; 



^ < j^i^A^M) ■ ( 62 ) 
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The operator A has the eigenvalue 1 occurring with multiplicity either or 2 and the 
eigenvalue l/d p occurring with multiplicity 2d 2 p . This follows from Lemma [7| where 
we have determined the spectrum of blocks of the form B p ' p . Denote the spectral 
decomposition of A by 

A = P+j-Q (63) 
dp 

where P, Q are projectors. We bound the sum of the weighted variances by looking at 
P and Q/dp separately. We have 



^aMMjlQ/dpmm <E? = 2 - ( 64 ) 

We also have 



d 



%• Mi I \P\i>i)\i>j) < rank P < 2 (65) 

jeJ 

where the first inequality follows by Lemma 12 in Putting these two bounds 

together and multiplying by l/(2d p ) 2 , we obtain the desired result. □ 

Now we can use this result to show that Pi s and P\ are probably close: 
Lemma 10. 

Pr (||Pi s -Pi||i>e- e ("))<e- e ^ (66) 
sealed 

Proof. For any fixed representation p 6 G, according to Chcbyshcv's inequality, 

2 

Pr (Mj» -Pi(j)\ > ajc) < -X (67) 

Sfcu CLj C 

for any c > 0. Now define 

^bad := {j € J : \pi(j\s) - pi(j)\ > a jC } , (68) 

and define </| ood ■= J — J^d- The total variation distance can be decomposed into 
contributions from good and bad j's. For the good j's, we have 

J2 |pi0»-pi(j)| < E a i c ( 69 ) 

< 2d p c . (70) 
Now for any j £ J (and in particular, for j € ^bad)> we nave 



|piO»-pi(?)| = ^-K^|s"(«)-b''|Vj>| (71) 

<^-p"(*)--B"|| (72) 
< J • (73) 
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Thus it suffices to show that Y]j^ js Oj is small. The expectation of this quantity is 



J G E a i = pEE fl i^' € J badl (74) 

ie./^d seGjeJ 

= E^P^' eJ bad) (75) 



< 



a 2 



s (77) 

where in the last line we have used Lemma H (assuming p ^ 1, which we will later 
ensure). Hence by Markov's inequality, 

,78) 

J tl/ bad 

for any d > 0. Conditioning on this event, we have 

||-Pi, s -Pi||i= E \Pi(3\ s )-PiU)\+ E \PiU\s) - Pi(j)\ (79) 



<2d„c+4- (80) 



with probability at least 



Hence if we choose 



dpC 2 c' 



J -3«n 



(81) 



(82) 



c' = e d£m (83) 



for some fixed a > 0, we find 



||P M -Pi||i <2e- Q " + — - (84) 

dp 

with probability at least 

1 - e- an . (85) 

For Pi jS and Pi to be close with high probability, it suffices that d p is large with high 
probability, so that the second term of l|84() is small. Thus we condition on the event 
that dp > n c " for some constant c", which occurs with probability at least 1 — n~ n ^ 
[271 Lemma 6]. This completes the proof. □ 

Finally, we must show that the probability distributions Pi and Pi are close in total 
variation distance: 
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Lemma 11. For an arbitrary POVM acting on a single copy of the hidden shift state, 



for p ^ 1 and 



for the trivial representation 1. 



PI - P 2 1 = (86) 



\Pl-Ph<\ (87) 



Proof. Let B be the block corresponding to the measured representation. Let A := 
| J — B\. Then we have 

\\Pi - Pi\\ = ^-E^l^-I^l^) " (^Wi>| (88) 

P 3 
P 3 

= ^tr(A). (91) 

We have determined the spectrum of -B in LemmaEl from which the lemma follows. □ 

Putting these results together, we can now prove the main result: 

Proof of Theorem\Q Since the trivial representation only appears with probability 1 /n!, 
we can simply condition on not obtaining the trivial representation, and the result 
follows from Lemmas E3 ancl El D 
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A Rank calculations 

(k) 

Although the measurement that projects on the support of 7^ need not be optimal in 
general, it is nevertheless a natural measurement to consider — for example, an analo- 
gous measurement was used in ^U] to show that 0(n log n) hidden subgroup states are 
sufficient to solve a hidden subgroup problem relevant to graph isomorphism. Since we 
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are trying to distinguish 7} from the maximally mixed state, the success probability 

(k) 

of the measurement that projects onto the support depends only on the rank of j{ 
(see (G3J0- Here we summarize some results on the rank for k — 1 and 2. 
For the case k = 1, Lemma immediately gives 

rank 7l 1) = 2\G\ - 1. (92) 

For the case k = 2, Lemma {7\ gives the contribution to the rank from the cases 
where the same irreducible representation /) ^ 1 occurs twice. It is straightforward to 
calculate the contribution from the other cases, giving the final result 

rank 7l 2) = 4|G| 2 - 6|G| + 3 + ^ d 2 (93) 

p£G, d p >l 

= 4|G| 2 -5|G|+3-|{peG:d p = l}|. (94) 

In particular, for G = S n , we have |G| = n\ and only two one-dimensional representa- 
tions (the trivial and sign representations), so 

rank 7l 2) = 4(n!) 2 - 5n! + 1 . (95) 

Calculations of the rank for larger k would seem to require a better understanding 
of the structure of j[ k ' . 
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